How to Write a HIPAA Authorization a Records Department Cannot Reject: The Nine Elements Plus Your State's Lines (Free Generator)

By John Mahoney · January 19, 2027 · 7 min read

A rejected records request costs three to six weeks, and most rejections are avoidable. The provider's release-of-information office is checking your authorization against a short list, and if any item is missing they are right to refuse. The list is in the federal regulation, the state adds a few lines of its own for sensitive records, and certain categories need a separate form entirely. This post lays out the list, the state overlays and the two federal special cases, and shows what the free generator does with them.

The nine things the federal rule requires

45 C.F.R. § 164.508 governs uses and disclosures of protected health information that require an authorization. Paragraph (c) lists what a valid one contains. Six core elements:

1. A description of the information to be disclosed that identifies it in a specific and meaningful way.
2. The name or other specific identification of the person or class of persons authorized to make the disclosure.
3. The name or other specific identification of the person or class of persons to whom the disclosure may be made.
4. A description of each purpose of the disclosure. "At the request of the individual" is sufficient when the patient initiates the authorization.
5. An expiration date or an expiration event that relates to the individual or the purpose.
6. The signature of the individual and the date, and if a personal representative signs, a description of the representative's authority.

And three required statements:

1. The individual's right to revoke the authorization in writing, with the exceptions and how to do it (or a reference to the notice of privacy practices if it is described there).
2. Whether the covered entity may condition treatment, payment, enrollment or eligibility on the authorization.
3. That information disclosed under the authorization may be redisclosed by the recipient and no longer protected by the federal rule.

The form must be in plain language and the individual must receive a copy. An authorization is defective if the expiration has passed, a required element is missing, it is known to have been revoked, or it is improperly combined with another document. That last point is where the special cases come in.

Two federal special cases

Psychotherapy notes

Section 164.508(b)(3)(ii) bars combining an authorization for psychotherapy notes with an authorization for anything else. Psychotherapy notes are the therapist's own session notes kept separate from the rest of the record. They do not include diagnoses, medications, test results, treatment plans, session times or progress summaries; all of that is ordinary mental-health record and comes with the main authorization. In most cases the clinical record is what you want. Ask for the notes separately only if you need them, and expect that the provider may decline.

Substance use disorder records

Records from a federally assisted substance use disorder treatment program are governed by 42 C.F.R. Part 2 in addition to HIPAA. A Part 2 consent has its own element list and must travel with a notice that the records may not be redisclosed, and the records may not be used in a civil, criminal, administrative or legislative proceeding against the patient without consent or a specific court order. A subpoena alone does not reach them. If your request may touch a treatment program, the form needs the Part 2 paragraph and the redisclosure notice, and you should expect the program to apply the rule strictly.

State overlays

HIPAA is a floor. Many states require a separate, specific consent before a provider may release certain categories even when a general release is signed: HIV or AIDS-related information, mental-health records, substance-use records, and genetic test results are the usual four. The practical consequence is a form with separately initialed paragraphs, each citing the state statute, so the release-of-information clerk can see at a glance that the specific consent exists. Several states also treat an authorization as expired after a fixed period unless it says otherwise, which matters when litigation runs for years. Statute numbering moves; several states have reorganized their health codes recently, so a citation that was right two years ago may now point to a repealed section.

Three habits that prevent rejections

• Have the patient initial each sensitive-record paragraph and sign once at the end. A blank HIV or mental-health line with a signature on the last page is the most common reason a form comes back.
• Match the expiration to the matter. "Upon conclusion of the legal matter for which this authorization is given" is a valid event-based expiration under the federal rule; check whether the state caps it.
• Pair the authorization with the fee rule. Send it with a cover letter that states the format requested and the applicable fee statute, and consider having the patient also request a copy for themselves under the right-of-access provision at 45 C.F.R. § 164.524, which carries its own fee limits.

A worked example (hypothetical)

The facts below are invented for illustration. No real patient, provider or case is described.

A personal injury firm represents a 41-year-old man injured in a fall at a store. His medical history includes treatment for depression and a stay at a residential substance-use program three years before the fall; the defense will argue his pre-existing conditions explain his symptoms. The paralegal needs the orthopedic records, the primary care records, the psychiatric records and the treatment-program records from a provider in a state that requires a separate mental-health consent and applies a three-year cap to authorizations unless stated otherwise.

Run through the generator, the output is two documents. The main authorization names the patient, each provider, the firm as recipient, "legal representation of the patient (claim evaluation and litigation)" as the purpose, the date range, and an expiration "upon conclusion of the legal matter," with the state flag noting the cap and adding the required language to extend beyond it. It carries the six elements and three statements in order, then a separately initialed mental-health paragraph citing the state statute and a separately initialed Part 2 paragraph with the redisclosure notice. The second document is a stand-alone psychotherapy-notes authorization, generated because the paralegal ticked that box; after reading the explanation, she decides not to send it and requests the clinical record first.

The treatment program still asks for its own form. That is common with Part 2 programs and is not a defect in yours; send theirs with the Part 2 paragraph language carried over.

What the tool does not do

The generator writes the form. It does not verify that a particular provider will accept it, does not know whether a given program is federally assisted under Part 2, and does not replace a check of the current state statute, which is why each state entry shows the date it was compiled and a confidence flag. Read the flags, confirm the citation for any sensitive category before the form goes out, and keep a copy of what the patient signed.

Frequently asked questions

What must a HIPAA authorization contain to be valid?

Under 45 C.F.R. § 164.508(c), six core elements: a specific description of the information, who is authorized to disclose it, who may receive it, each purpose of the disclosure, an expiration date or event, and the individual's dated signature (with a description of a personal representative's authority if someone else signs). And three required statements: the right to revoke in writing and how, whether treatment, payment, enrollment or eligibility is conditioned on signing, and that the information may be redisclosed by the recipient and no longer protected. It must be in plain language and the patient gets a copy.

Why do psychotherapy notes need a separate authorization?

Because the regulation says so. 45 C.F.R. § 164.508(b)(3)(ii) prohibits combining an authorization for psychotherapy notes with an authorization for any other information. Psychotherapy notes are the therapist's own session notes kept apart from the chart; diagnoses, medications, treatment plans and progress summaries are ordinary mental-health records and come with the main form.

What does the free HIPAA Authorization Form Generator actually do?

You pick the provider's state, enter the patient, provider, recipient, purpose, date range and expiration, and tick the record categories. It writes every core element and required statement of § 164.508 in order, adds the state-specific, separately initialed paragraphs for mental health, HIV, substance use (with the 42 C.F.R. Part 2 consent elements and redisclosure notice) and genetic information with the statute cited, writes a second form if psychotherapy notes are requested, and flags any state cap on the authorization period. Copy, download or print. The patient details never leave your browser.

Related: The medical records request checklist, how much a hospital can charge for records and HIPAA compliance in medical record review.